Bug #7530
closedKerberos: sname/cname code and suricata documentation both wrong
Description
In the suricata documentation the cname and sname are described as client and server name. https://docs.suricata.io/en/latest/rules/kerberos-keywords.html
But the suricata code in github, describe the krb5_cname and krb5_sname as their respective principal name: 
These were contradicting, so we did a test and it looks like the the krb5_cname is the client service principal and the sname is the destination server, so it appears that both the docs and the code documentation is wrong.
Files
Updated by Philippe Antoine 3 days ago
- Related to Documentation #6566: userguide: add description for missing EVE krb fields added
Updated by Philippe Antoine 3 days ago
- Status changed from New to Rejected
For what I understand cname and sname in Suricata are the same as in the RFC 4120
For example cname is described there as :
This field contains the name part of the client's principal identifier.
So, all looks good to me, but I may be wrong :
If you have a pcap where you get a different value than expected for cname or sname, please provide it
If you have a better wording for docs or code comments, a PR is welcome
Feel free to reopen if you have more details